UPDATED
GitHub Engineering Blog · · Medium severity
Working with outside collaborators can add more work for a repository owner. You need to confirm who still needs access, change permissions as projects evolve, and archive repositories once they’ve served their purpose. To keep up,...
Ubuntu security notices · · Medium severity
It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu...
The Register · · Medium severity
Security researchers warned about exploitable vulnerabilities in refrigeration controllers months - and in one case, more than a year - before cyberattacks disrupted hundreds of French supermarkets. Late Sunday night, unknown criminals...
darkreading · · Medium severity
AI has been dumbing down cyberattacks, and serious threat actors are barely touching it.
Wired · · Medium severity
Powerful AI models continue to cause chaos, but their targets aren’t widely seeking justice. Instead, they’re being encouraged to adopt those same tools.
The Record by Recorded Future · · Medium severity
The incident, which involved a government contractor, has halted all production of bankruptcy notices.
The Hacker News · · Medium severity
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it....
HackRead · · Medium severity
Citizen Lab found targeted ads delivered Candiru spyware to Al Jazeera devices without clicks, while the same ad…
BleepingComputer · · Medium severity
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.
BetaKit · · Medium severity
Researchers at the University of Toronto have identified, for the first time, a spyware hack run simply through targeted ads—no clicking necessary. The news: A joint report by the University of Toronto’s Citizen Lab and cybersecurity...
TechRadar · · Medium severity
Experts uncover bizarre new malware that spooks users with jump scares and screams
The Record by Recorded Future · · Medium severity
Powerful zero-click spyware is infected devices worldwide through targeted ads, new research shows — an alarming development in the spread of surveillance technology.
The Hacker News · · Medium severity
Someone built a tool to steal data, then decided it should scare the victim for fun. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways.
PYMNTS.com · · Medium severity
England’s central bank is warning lenders they shouldn’t assume they are invulnerable to artificial intelligence (AI)-powered cyberattacks. Sarah Breeden, deputy governor of the Bank of England (BoE) said Thursday (Oct. 15) that...
GitLab · · Medium severity
Credentials often start in an engineer's local dev environments, then get copied into unscoped CI/CD variables to keep pipelines running. Stored there as a raw value rather than a reference to a scoped secret, a signing key reaches...
Ubuntu security notices · · Medium severity
USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This update provides the corresponding fix for Go version 1.23. Original advisory details: It was discovered that the Go x/net/idna package incorrectly handled...
SecurityWeek · · Medium severity
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate. The post Context Is King in the Fight Against Modern Cyberattacks appeared first on SecurityWeek .
CISA KEV · · Critical severity
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability. Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,...
BleepingComputer · · Medium severity
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru.
Ars Technica · · Medium severity
Following a string of incidents where AI models hacked websites and breached government systems during testing phases, the Federal Trade Commission is officially probing Anthropic and OpenAI over consumer harms, an insider told Axios ....
All CISA Advisories · · Medium severity
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107333, CVE-2026-107362, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm <=v26.08.0 () CVSS...
All CISA Advisories · · Medium severity
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The...
All CISA Advisories · · Medium severity
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App <=4.9.6...
All CISA Advisories · · Medium severity
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a...
All CISA Advisories · · Critical severity
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. The following versions of Thermo Fisher Torrent Suite Software are affected: Torrent Suite Software...
Cybersecurity Dive - Latest News · · Medium severity
The investigation points to a much wider risk for industrial systems across the globe.
Schneier on Security · · Medium severity
Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption has...
The Hacker News · · Medium severity
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026,...
Cybersecurity Dive - Latest News · · Medium severity
Vulnerability disclosures and hacking campaigns haven’t made much of a dent in the amount of important infrastructure left online, a new report found.
TechRepublic · · Medium severity
The EU is questioning OpenAI and Anthropic over AI agent security incidents, raising questions about the AI Act's reach into model development and testing. The post EU Questions OpenAI, Anthropic Over AI Agent Security Incidents...
HackRead · · Medium severity
An misconfigured Vibetech database exposed 13.7 million records from previous breaches, including AT&T, Casio and FBI data, passwords and bank details.
Ubuntu security notices · · Medium severity
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - S390 architecture; - IIO ADC drivers; - Multiple...
The Hacker News · · Medium severity
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be...
AlienVault OTX · · Medium severity
This investigation reveals the first public confirmation of zero-click mercenary spyware delivered via targeted advertisements, termed AdFection. Devices at Al Jazeera were infected with Candiru spyware through malicious ads purchased...
AlienVault OTX · · Medium severity
The Aoki infostealer has evolved to target credentials from AI coding assistants including Claude, OpenAI's Codex, Cursor, Codeium and Gemini. This capability represents a recent addition, as earlier versions did not target AI-related...
The Record by Recorded Future · · Medium severity
A cyberattack on Britain’s Legal Aid Agency (LAA) stole far older and broader records than the government previously disclosed.
SecurityWeek · · Medium severity
Most of the data is related to applications, claims, and payments submitted between 2007 and 2025. The post UK Legal Aid Agency Hack Scope Widens After Forensic Review appeared first on SecurityWeek .
AlienVault OTX · · High severity
DragonForce is a financially motivated ransomware operation that emerged in August 2023, initially using leaked LockBit 3.0 code and later transitioning to Conti v3-based variants. Operating as a Ransomware-as-a-Service model, they...
The Hacker News · · Critical severity
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server...
Hackaday · · Medium severity
Perhaps the most exciting news of the past few weeks in the world of hardware hacking has been the unlocking of hidden SDR functionality in the Wi-Fi radios found on Espressif ESP32 microcontrollers. They can be used as both transmit...
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free